Cyber attacks put trustees’ response plans to the test
Byline: Karen Jones, founder of Citywealth, has more than 20 years’ experience in global private wealth.
Recent attacks show how quickly cyber incidents can threaten assets, confidential information and confidence in trustees. Experts explain how preparation, clear controls and a co-ordinated response can help limit the damage.
Trustees have long had to balance the protection of wealth with the needs of beneficiaries, the demands of regulation and the realities of succession. In previous Citywealth trust updates, advisers discussed long-term planning, trust administration and the importance of clear governance as wealth passes between generations. The latest risk to that work is increasingly digital.
Major cyber incidents have shown that attackers may target a financial institution’s systems, its suppliers or the people with access to them including household names such as M&S in the UK. In October 2026, crypto exchange Binance reported that US$6.34 billion in digital assets had been affected by an incident involving unauthorised transfers. This is no longer just a crypto problem or eco system. Binance have an Abu Dhabi investor MGX, an AI and advanced technology investment company. In March 2025, it announced a US$2 billion investment in Binance in exchange for a minority stake. Binance immediately said it had frozen or intercepted about US$2.85 billion and that its investigation was continuing.
The FBI has attributed the attack to North Korea; Binance’s initial report describes a multi-stage campaign and compromised systems including an engineers laptop being specifically targeted. Raising alarm bells about working from home security for laptops in multiple locations.
In another such incident in July 2026, Liechtenstein’s government said attackers gained unauthorised access to its Register of Beneficial Owners and copied data relating to around 31,000 legal entities. The register includes companies, foundations and trusts. Officials said bank client, account, asset, transaction and advisory information were not affected. The incident highlights how a breach involving ownership information could raise privacy, fraud and reputational concerns, even where financial and transaction data are not involved. The main risk is targeted impersonation and social engineering, which means manipulating someone into giving away information or access through phishing emails for example, by pretending to be a trusted person or organisation.
For trustees, these events raise practical questions: how quickly can a response team be brought together across borders; who can suspend access or transactions; and how will evidence be preserved? Experts say the answers need to be worked out before an incident occurs.
Plan and rehearse the response before an attack
Michael Yates, partner and head of the cyber practice at law firm Harbottle & Lewis said: “Cyber-attacks and emerging threats must be stopped at speed. Minutes matter, so trustees must ensure they know the right legal and other experts to urgently turn to across the relevant jurisdictions and appoint them in advance, making sure they are joined up. Collaboration is key when dealing with threats, such as cyber or deep fake attacks. Preparation should include creating crisis and cyber response plans, and testing their resilience by carrying out a breach simulation exercise with legal and forensic experts and strengthening defences following the exercise. All employees should be educated on a continual basis.”
Kenny Mullen, IP partner, London, Withers law firm said: “Trustees in the UK have a legal duty of care to which extends to the security of assets under their care. We advise private clients, trustees, and family offices regularly on data security issues. Key recommendations would be to adopt a cyber incident response plan, then to verify and rehearse this though tabletop exercises regularly or annually, if possible.”
“They should have an incident lead team of key internal stakeholders and external adviser group ready to go across key territories. This should include forensic professionals; technical support; legal advisors who can co-ordinate regulatory reporting; stakeholder notifications and advice on legal responsibilities.”
Mullen adds. “Check insurance. Does your insurance protection for cyber issues do what you think? Have your checked deductibles, conditions, exclusions, and limits on your cover?”
“Verify your partners. You are only as secure as your supply chain. The cyber resilience of external administrators, custodians and managers should be reviewed. Do your contracts comply with data protection and security laws. Have you received assurance on information security; incident notification; co-operation and audit rights; liability allocation?”
Human error triggers many incidents
“Control your assets. Human error still triggers many incidents. To protect assets, operations safeguards should be adopted and followed by staff, so dual authorisation for significant payments; call back if banking details are amended; system privileges limited on a need to know basis. Then review staff training and policies. Have regular data security training at all levels from trustee down is essential. Adopt and enforce a clear policy on responsible use of IT systems and AI across the organisation. Ensure that awareness is kept up to date as threats evolve.”
Secure the people and processes with access
Some trustees depend on large institutions with dedicated security resources. Others, particularly individual trustees and smaller organisations, may have fewer protections or rely on a small number of people to manage sensitive systems. Experts say both cases need clear access controls and regular training.
Joshua S. Rubenstein, Partner, Global Chair, Private Wealth Department, Katten said: “Corporate trustees that are part of large financial institutions, while not immune from cyberattacks, have extensive resources at their disposal and have developed sophisticated, secure systems, so much so that even the most mundane e-mail from them is encrypted, sent from a secure platform, and requires you to register with them in order to see the e-mail and attachments.”
“In the United States, it is more common than in other parts of the world for individuals to serve as trustees. In such cases, not only are trustees’ e-mail and data storage systems not necessarily as secure as they might be, but the individuals who have access to the system, including the trustees themselves, are often tricked by hackers into granting accesses. For example, it is becoming increasingly common for cybercriminals to pose as a trustee’s IT department, and then getting the trustee’s access codes to help with a fictitious but reasonable sounding problem. Individuals are often the weakest link in the chain, and should all take cyber security training courses.”
Insurers insist on cyber security training
“Insurers are catching on and now insisting, as a condition to providing fiduciary liability insurance, not only that trustees take cyber security training courses, but also that trustees never use public wifi, including at a hotel where a password is required. Rather, they are insisting that when trustees travel, they use a portable device that creates its own secure and encrypted wifi, and connect only to that.”
Michael Yates added:
“Protecting against the ‘insider threat’ is very difficult because no one expects their trust to be broken. It is essential to be able to track lateral movement across systems by any threat actor and then have the right advisors in place to obtain specialist injunctions to image, delivery up, remove and prevent the further disclosure of stolen, private and confidential data and information. The necessary contractual provisions must be built into employment contracts.”
Cyber risk is not a new category of risk
Paul Davidoff, Private Client Partner, Kingsley Napley said:
Cyber risk is not specifically a new category of risk. Rather, it is the latest iteration of risks that have always existed across every asset class. Cash held at a bank, shares held via a platform, land registered at the Land Registry, artwork in storage: each carries its own vulnerability to fraud, theft, negligence or system failure. What digital assets, and cryptocurrency in particular, do is amplify those risks in new ways.”
“A crypto exchange account can be hacked, a hardware wallet can be lost, damaged or corrupted, and the underlying asset rendered worthless by technological change or a successful attack on the blockchain verification process itself. Trustees holding digital assets on behalf of beneficiaries face all of these risks. They also have the added complexity that the regulatory and recovery frameworks in different jurisdictions remain inconsistent and, in many cases, immature.”
“The internal threat is, if anything, more insidious than the external one. A trustee company’s greatest vulnerability may not be some sophisticated external cyberattack, but an employee or contractor who already has legitimate access to information about trusts, including ownership records and transaction instructions. The controls that will make the most difference are practical rather than over-elaborate, but they do need to be proactively identified, implemented and then enforced.. These could include strict dual-authorisation requirements for any transaction above a defined threshold, genuine segregation of duties so that no single individual can both initiate and approve a transfer, regular independent audits of access logs and transaction records and robust vetting at the point of recruitment. None of these can guarantee immunity from fraud, but each will raise the bar and reduce the likelihood of a successful internal fraud happening. As an aside, should additional consideration be given to preventing two related individuals within the same organisation being both the initiator and the approver of a transaction? In some cases that would be impractical, especially in a small business set up and owned by a couple, but in others it might be a proportionate and sensible step.”
Avoiding accusations of negligence
“When something does go wrong, whether as a result of an external attack or an internal breach, the cross-border dimension of many larger trust structures creates its own layer of difficulty. Preserving evidence, notifying the relevant authorities, freezing assets and co-ordinating legal responses across multiple jurisdictions requires advance planning, not improvisation. Trustees could benefit from conducting a “disaster planning” exercise to identify not just potential exposure, but also key contacts in each relevant jurisdiction who may be able to help both in planning their security procedures and their incident-response procedures. Doing so would certainly help to avoid an accusation of negligence when something does go wrong.”
Treat service providers as part of the risk
Trust structures often rely on administrators, custodians, advisers and technology providers across several jurisdictions. A breach at one of these organisations can affect a trust even if the trustee’s own systems remain secure.
Delays in the first 24 to 48 hours can significantly increase losses
Charlotte Hill, Partner and Solicitor-Advocate, Commercial Dispute Resolution, Penningtons Manches Cooper said:
“The recent Binance incident is a reminder that cyber security is no longer simply an operational issue for trustees; it is a core risk management and governance issue. For trustees overseeing structures with beneficiaries, assets, counterparties and service providers spread across multiple jurisdictions, the first priority following a cyber incident is rapid containment and coordination. That means activating a pre-agreed incident response plan, securing systems and assets, preserving forensic evidence, engaging specialist cyber and legal advisers, and assessing whether any regulatory, reporting or disclosure obligations have been triggered. Delays in the first 24 to 48 hours can significantly increase losses and make recovery more difficult, particularly where digital assets or cross-border transfers are involved.”
Manageable incidents or a full-scale crisis
“Trustees should also recognise that not all fraud originates from external attackers. Some of the most damaging incidents involve employees or contractors with legitimate access to sensitive information, ownership records or payment processes. Effective controls therefore need to address both external and internal threats through robust access management, segregation of duties, transaction verification procedures and ongoing monitoring for unusual activity. In the aftermath of an incident, the focus must be not only on identifying what happened and recovering assets where possible, but also on demonstrating to beneficiaries and stakeholders that the trustee acted decisively, preserved evidence, and took appropriate steps to minimise harm. In an increasingly interconnected and digital environment, preparedness is often the difference between a manageable incident and a full-scale crisis.”
Charlotte Hill added:
“A good but slightly historic example is the crypto company Bybit hack in February 2025, which was reported as the (then) largest crypto theft in history, with around US$1.5 billion stolen. What makes the incident particularly interesting is that the problem did not appear to sit with Bybit’s own wallet security. Instead, attackers allegedly compromised a trusted third-party provider involved in the transaction approval process, allowing fraudulent transactions to be authorised.”
“The key lesson for trustees is that cyber risk is no longer confined to their own systems. It sits across an entire ecosystem of custodians, administrators, advisers and technology providers. Increasingly, organisations are only as secure as the weakest link in their supply chain, which is why oversight of third-party providers and rehearsed incident response plans are so important.”
The exposure of sensitive ownership and beneficiary information
“Another interesting example, as mentioned, albeit in a slightly different context, is the Liechtenstein beneficial ownership register breach in the Summer of 2026. For trustees, it shows that the biggest cyber risk is not always the theft of assets. The exposure of sensitive ownership and beneficiary information can create significant risks around fraud, social engineering, privacy and reputation. Once that information is out in the wild, the focus shifts from recovering money to managing the long-term consequences of a loss of confidentiality.”
“Put simply, for trustees the real question is often not “Can someone steal the assets?” but “What could someone do with the information they have obtained?””
Build resilience, not just defences
Preventing every attack may be impossible. Trustees can still prepare for disruption by deciding in advance who has authority, what systems can be isolated, how records and backups will be protected, and how the organisation will communicate with beneficiaries and other stakeholders.
Bruce McDougall, Director, Black Arrow Cyber Consulting Limited said. “Trustees cannot assume that the right cyber security arrangements are in place. With attackers using AI to increase the speed and scale of attacks, trustees need to assure themselves not only on cyber security (to reduce the chances of a successful attack) but increasingly on cyber resilience (to increase the chances of surviving the successful attack). This must include risks and dependencies across connected third parties. A cyber incident is a business leadership issue, not just an IT issue. Trustees, administrators and advisers should plan to work together across jurisdictions and business time zones, including who has authority to restrict system access or suspend transactions, how evidence will be preserved and who will communicate with stakeholders. In our experience with clients, the response must be rehearsed in a leadership workshop supported by an impartial expert in cyber security and business operations; representatives from technology should participate but not feel obliged to reassure that the incident could not happen.”
The trauma of an attack
“Remember though, responding to a cyber incident is not just about making decisions; it is about having the tools ready. An attacker might try to destroy your backup and your records (logs) of the attacker’s actions, which is why these must be protected and tested, but many victims do not know this until they have gone through the trauma of an attack. It is important to upskill on the basics of cyber security and align to a structured framework, to help ensure these and other considerations are addressed; an impartial expert can help guide on the questions to ask of your technology and other control providers.”
Conclusion
Trustees’ responsibilities continue to centre on protecting assets and serving beneficiaries. The growing dependence on digital records, payment systems and external providers adds new ways those responsibilities can be challenged. The recent incidents show why cyber security belongs in trustee governance: plans need to be tested, access and payment controls need to be clear, and advisers across relevant jurisdictions need to know their roles before a crisis begins.
Key Takeaways
- Recent cyber attacks have highlighted the urgent need for trustees to strengthen their response plans and security measures.
- Trustees must prepare by developing incident response strategies, coordinating with legal experts, and training staff on cybersecurity best practices.
- Cyber risk is not new but has evolved; digital assets and third-party vulnerabilities create unique challenges for asset protection.
- Trustees should view cyber security as a governance issue, ensuring rapid containment and well-rehearsed action plans during incidents.
- Building cyber resilience is essential; trustees must focus on preparedness, clear access controls, and effective communication with stakeholders.
Karen Jones is the founder of Citywealth and a wealth management commentator with more than 20 years’ experience across global private wealth, family offices and succession. Before founding Citywealth in 2005, she held publishing roles at The Times and The Sunday Times, London; Legal Business magazine and worked on the Asia Pacific Legal 500.
Subscribe to the Citywealth Weekly Newsletter to learn more about Private Wealth Management.
Read more:
IFC insights: Indian wealth management
The Global Migration Shake-Up: Why the Wealthy Are Moving
Citywealth Leaders List: Top 30 Immigration Advisors 2026
Citywealth Forum 2026 – Speaker: Matthew Briggs, Boyes Turner
60 seconds with Matthew Briggs, Boyes Turner
AI, Capacity and the Older Client: Who Is Really Giving the Instruction?
Elder law update: How can advisers confirm that polished, AI-assisted instructions genuinely reflect a client’s wishes?
The best and worst laws in private client, tax and family
From lifetime gifts to marriages that revoke wills, private wealth advisers identify the rules that help families plan ahead and those they believe need reform.